CVE-2026-13993
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk5th percentile — higher than 5% of all known CVEs
Summary
A vulnerability in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker, after convincing a user to perform specific UI gestures, to spoof domains via a crafted HTML page.
Risk Assessment
The risk involves tricking users into believing they are on a legitimate domain, potentially leading to credential theft or other sensitive data exposure.
Recommendation
Update Google Chrome to version 150.0.7871.47 or later immediately, which includes a fix for this vulnerability.
Original NVD description (English source)
Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)